GDPR & your data

• Access — a copy of the personal data we hold about you.
• Rectification — correcting data that is wrong or incomplete. Most company data can be changed directly in Companies.
• Erasure — deleting your data, except what we must keep by law (see below).
• Restriction — pausing the use of your data while a question about it is resolved.
• Portability — your data in a structured, machine-readable format.
• Objection — to uses based on our legitimate interest, such as usage analytics.
• Alerts — switch off lot alerts at any time from the link in every alert email.

Sanctions screening compares company names with the EU sanctions list automatically. It never refuses anyone on its own: a possible match is reviewed by a person at ELX, and you can ask for that review to be explained.

Some records must be kept even if you ask us to delete them: verification records, including identity documents, for five years after the business relationship ends (anti-money-laundering law), and transaction, invoice and payment records for as long as tax and accounting law requires. We delete them when that period ends.

Write to contact@elx.com from the email address of your account. We may ask you to confirm your identity. We answer within one month; if a request is complex we may extend that by up to two more months and tell you why.

You can complain to the data protection authority where you live or work — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC). We would appreciate the chance to resolve it with you first.

How we use personal data is described in full in the Privacy Policy.